5 ms·

"The panic that this caused only got worse on Monday when Mark provided the first explanation: the exchange had run up against a flaw in the Bitcoin protocol. T

"The panic that this caused only got worse on Monday when Mark provided the first explanation: the exchange had run up against a flaw in the Bitcoin protocol. The flaw, known as transaction malleability, allowed devious users to request a withdrawal, change the code, and then successfully request the same withdrawal again." It was my understanding that double spending wasn't possible?

VMG 11y ago
Double spending was not possible. This (known) flaw was about being able to change certain parts of a transaction that were unsigned, allowing multiple equally valid transfers to have different ids. Only one of then ends up in the blockchain, however. You could thus not rely on a transaction id as a reference to see if a payment was made, but some systems did nonetheless. See https://en.bitcoin.it/wiki/Transaction_Malleability https://en.bitcoin.it/wiki/Transaction_Malleability
- yc1010 11y ago
  And anyways the transaction malleability "excuse" was debunked, it can not explain millions worth of bitcoins AND millions worth of USD "disappearing" from their bank as well. http://www.theregister.co.uk/2014/04/09/mt_goxs_transaction_malleability_claim_rubbished_by_researchers/ http://www.theregister.co.uk/2014/04/09/mt_goxs_transaction_... Karpeles is either a deliberate fraud (he does have a prior history) or possibly a bad programmer whose bugs in code dealing with money caught him with his pants down... Eitherway he has greatly damaged Bitcoin name with his shenanigans, blaming transaction malleability was one of the straws he tried to clutch at as his house of bad code collapsed, he also tried to blame his staff and few other tricks.
  - __z 11y ago
    >a bad programmer He certainly didn't understand a lot about security. In the original topic on bitcoin talk (https://bitcointalk.org/?topic=444.0 https://bitcointalk.org/?topic=444.0) someone pointed out he was sending passwords in the query string. He replied "It is a post over https. It is secure." ignoring the other (obvious) problems with putting passwords in the query string (http://security.stackexchange.com/questions/29598/should-sensitive-data-ever-be-passed-in-the-query-string http://security.stackexchange.com/questions/29598/should-sen...)
stygiansonic 11y ago
Here's an explanation[0] of the issue. As a summary: Apparently they were using the hash to track transactions, and would re-send bitcoins if the transaction didn't appear to go through. This is obviously a problem if the transaction did go through, but with a different hash. Basically, two transactions which effectively do the same thing can end up having a different hash. Because of this, one should not rely on looking for the hash in the blockchain to see whether a transaction has "gone through". This has been a {known issue, flaw} since 2011, but some BTC exchanges (like Mt. Gox) continued to rely on the transaction hash to check whether transactions had been committed to the blockchain. If a transaction hadn't appeared to have gone through, they re-sent bitcoins (under a new transaction). This is a problem if the transaction did indeed go through, but under a different hash, as it would cause the same action (transfer money from A to B) to show up in the blockchain twice. 0. http://www.righto.com/2014/02/bitcoin-transaction-malleability.html http://www.righto.com/2014/02/bitcoin-transaction-malleabili...
maxerickson 11y ago
Double spending refers to attacking the bitcoin network to rewrite history and use the same coins twice. It is merely infeasible. In the case of Mt Gox, poor internal accounting controls made it possible to make repeated withdrawals. Say a standard transfer is initiated by sending Mt Gox a message, [Mt Gox, send me money.], which causes Mt Gox to check that the funds are available, initiate a legitimate bitcoin transaction and debit the Mt Gox account for that amount. Their system was set up so that if you sent a specially formed message like [Mt Gox, send me MORE money.], it would check that the funds were available, initiate a legitimate bitcoin transaction and not bother debiting the Mt Gox account. That isn't quite technically accurate (the attack involved getting Mt Gox to respond to a different message than ended up on the consensus blockchain), but it captures where the problem was, Mt Gox wasn't keeping track of funds in a careful way.
mootothemax 11y ago
It was my understanding that double spending wasn't possible? While I'm far from authoritative on the matter, under certain circumstances, it appears to be very possible. Here's one person's explanation of their $10,000 double-spend during a hard fork of the blockchain: https://bitcointalk.org/index.php?topic=152348.0 https://bitcointalk.org/index.php?topic=152348.0 A mining pool also manipulated the block chain to run a double-spend attach against a dice betting site: http://www.reddit.com/r/Bitcoin/comments/1qqmr4/ghashiocexio_and_doublespending_against_betcoin/ http://www.reddit.com/r/Bitcoin/comments/1qqmr4/ghashiocexio...

VMG 11y ago

Double spending was not possible. This (known) flaw was about being able to change certain parts of a transaction that were unsigned, allowing multiple equally valid transfers to have different ids. Only one of then ends up in the blockchain, however. You could thus not rely on a transaction id as a reference to see if a payment was made, but some systems did nonetheless. See https://en.bitcoin.it/wiki/Transaction_Malleability https://en.bitcoin.it/wiki/Transaction_Malleability

yc1010 11y ago
And anyways the transaction malleability "excuse" was debunked, it can not explain millions worth of bitcoins AND millions worth of USD "disappearing" from their bank as well. http://www.theregister.co.uk/2014/04/09/mt_goxs_transaction_malleability_claim_rubbished_by_researchers/ http://www.theregister.co.uk/2014/04/09/mt_goxs_transaction_... Karpeles is either a deliberate fraud (he does have a prior history) or possibly a bad programmer whose bugs in code dealing with money caught him with his pants down... Eitherway he has greatly damaged Bitcoin name with his shenanigans, blaming transaction malleability was one of the straws he tried to clutch at as his house of bad code collapsed, he also tried to blame his staff and few other tricks.
- __z 11y ago
  >a bad programmer He certainly didn't understand a lot about security. In the original topic on bitcoin talk (https://bitcointalk.org/?topic=444.0 https://bitcointalk.org/?topic=444.0) someone pointed out he was sending passwords in the query string. He replied "It is a post over https. It is secure." ignoring the other (obvious) problems with putting passwords in the query string (http://security.stackexchange.com/questions/29598/should-sensitive-data-ever-be-passed-in-the-query-string http://security.stackexchange.com/questions/29598/should-sen...)

stygiansonic 11y ago

Here's an explanation[0] of the issue. As a summary: Apparently they were using the hash to track transactions, and would re-send bitcoins if the transaction didn't appear to go through. This is obviously a problem if the transaction did go through, but with a different hash. Basically, two transactions which effectively do the same thing can end up having a different hash. Because of this, one should not rely on looking for the hash in the blockchain to see whether a transaction has "gone through". This has been a {known issue, flaw} since 2011, but some BTC exchanges (like Mt. Gox) continued to rely on the transaction hash to check whether transactions had been committed to the blockchain. If a transaction hadn't appeared to have gone through, they re-sent bitcoins (under a new transaction). This is a problem if the transaction did indeed go through, but under a different hash, as it would cause the same action (transfer money from A to B) to show up in the blockchain twice. 0. http://www.righto.com/2014/02/bitcoin-transaction-malleability.html http://www.righto.com/2014/02/bitcoin-transaction-malleabili...

maxerickson 11y ago

Double spending refers to attacking the bitcoin network to rewrite history and use the same coins twice. It is merely infeasible. In the case of Mt Gox, poor internal accounting controls made it possible to make repeated withdrawals. Say a standard transfer is initiated by sending Mt Gox a message, [Mt Gox, send me money.], which causes Mt Gox to check that the funds are available, initiate a legitimate bitcoin transaction and debit the Mt Gox account for that amount. Their system was set up so that if you sent a specially formed message like [Mt Gox, send me MORE money.], it would check that the funds were available, initiate a legitimate bitcoin transaction and not bother debiting the Mt Gox account. That isn't quite technically accurate (the attack involved getting Mt Gox to respond to a different message than ended up on the consensus blockchain), but it captures where the problem was, Mt Gox wasn't keeping track of funds in a careful way.

mootothemax 11y ago

It was my understanding that double spending wasn't possible? While I'm far from authoritative on the matter, under certain circumstances, it appears to be very possible. Here's one person's explanation of their $10,000 double-spend during a hard fork of the blockchain: https://bitcointalk.org/index.php?topic=152348.0 https://bitcointalk.org/index.php?topic=152348.0 A mining pool also manipulated the block chain to run a double-spend attach against a dice betting site: http://www.reddit.com/r/Bitcoin/comments/1qqmr4/ghashiocexio_and_doublespending_against_betcoin/ http://www.reddit.com/r/Bitcoin/comments/1qqmr4/ghashiocexio...